How to use WhoisXML API in Combination 
with Maltego for Advanced Mapping and 
Reconnaissance of the Emotet Botnet 


Executive Summary 


The Emotet botnet continues making headlines in terms of its widespread spam and malicous 
software serving campaigns on a daily basis and with more researchers trying to profile and infiltrate it 
in terms of shutting it down or monitoring it we’ve decided to take a closer look at the modern Emotet 
botnet using Maltego and WhoisXML API’s integration for the purpose of providing timely and relevant 
including actionable threat intelligence and high-value information on its network infrastructure 
potentially offering clues as to the whereabouts of its network operators. 


We’ve decided to take a closer look at the Emotet botnet C&C infrastructure using publicly accessible 
and obtainable information on its C&C infrastructure using Maltego and WhoisXML API for the 
purpose of OSINT enrichment and to actually offer actionable and relevant threat intelligence type of 
information on the current whereabouts of the Emotet botnet. 


In this research and analysis we’ll use a sample seed malicious Emotet known and confirmed botnet 
C&C malicious and fraudulent IPs for the purpose of enrichment and will offer a detailed peek inside its 
network infrastructure including to offer additional set of malicious MD5s which we stumbled upon 
while profiling it for the purpose of assisting security researchers including clients and customers on 
their way to stay on the top of their game in terms of the Emotet botnet. 


01. Introduction to WHOIS XML API 


WhoisXML API is one of the Web’s and the security industry’s primary destinations for threat 
intelligence and cybercrime research, including OSINT types of domain, IP, and current and historical 
WHOIS data records with billions of domain, IP, and WHOIS records within WhoisXML API’s database. 
Novice and experienced cybercrime researchers and threat intelligence analysts, including OSINT 
experts and analysts, should consider adopting WhoisXML API’s products in their arsenal of OSINT 
tools and public database repositories and databases, largely considering the tools offered as their 
primary information sources and threat intelligence gathering solutions and publicly accessible 
databases for using them in their current and ongoing OSINT and cybercrime analyses including 
threat intelligence type of investigations. 


02. How to get a proper account 


Cybercrime researchers and threat intelligence analysts interested in obtaining access to one of the 
Web’s and the industry’s most comprehensive and in-depth data set of real-time and historical domain 
IP and WHOIS information should grab an account from the following URL - 
https://main.whoisxmlapi.com/signup for the purpose of beginning their OSINT and cybercrime 
research including their threat hunting and threat intelligence gathering process. 


Product Tier 1 Tier 2 Tier 3 Tier 4 Tier 5 Tier 6 Units 
WHOIS and Bulk WHOIS 100,000 500,000 1,000,000 2,000,000 5,000,000 10,000,000 Monthly queries 
Domain Availability 100,000 500,000 1,000,000 2,000,000 5,000,000 10,000,000 Monthly queries 
IP Geolocation 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
IP Netblocks 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
DNS Lookup 100,000 200,000 500,000 1,000,000 2,000,000 4,000,000 Monthly queries 
Email Verification 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Domain Reputation 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Website Categorization 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
bsite Contacts 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 


Sample WhoisXML API Pricing Plans Web Site 
03. How to install Maltego 


For the purpose of this case study we’ll use the popular OSINT gathering and enrichment tool Maltego, 
which you can grab from the following URL - https://www.maltego.com/downloads/ on your way to 
begin using and utilizing WhoisXML API’s advanced domain, IP, and historical and current WHOIS 
information and one of the Web’s and the industry’s most comprehensive and in-depth database. 


HH Maltego for Windows 


SELECT A FILE TYPE 


.exe + Java (x64) v 


https://maltego-downloads.s3.... ' 


You can view our change loghere > 


Java 11 64 bit is recommended. 


Sample Maltego Download Web Site 
04. How to use the WHOIS XML API Maltego Integration 


Before using Maltego users should follow the instructions and grab a proper WhoisXML API account 
which they can later on use for the actual research and OSINT research and analysis, including the 
actual enrichment process. 
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To Domains and IP Addresses (Historical Reverse WHOIS Search) [WhoisXML] 
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Sample Maltego GUI Interface relying on WHOIS XML API’s for OSINT research and analysis and 
actual network and domain reconnaissance and footprint including actual enrichment 


Users should then proceed with the actual OSINT research and enrichment process by importing the 
domains and actual IPs for their research in questions directly into Maltego by using the import feature 
or by manually adding them for the purpose of actually beginning the actual OSINT enrichment and 
research process. 


05. Profiling a Emotet’s Botnet Command and Control Infrastructure - A Case Study 


We've decided to use Maltego in combination with WhoisXML API’s integration for the purpose of 
doing an OSINT enrichment and actual research and analysis on the current state of the Emotet 
botnet in particular the actual botnet C&C infrastructure with the idea to provide actionable intelligence 
on the related malicious and fraudulent IPs including the actual malicious MD5s known to be 
participating in the campaign for the purpose of demonstrating how to use Maltego in combination with 
WhoisXML API for the purpose of establishing the foundations for a successful OSINT enrichment 
campaign and actual botnet C&C infrastructure profiling. 
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Sample Maltego Graph Analysis of a currently active Emotet Botnet C&C infrastructure 
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Sample Maltego Graph Analysis of a currently active Emotet Botnet C&C infrastructure 


In the initial set of data we’ve decided to collect publicly accessible and well-known by the community 
Emotet botnet C&C IPs and try to enrich them and offer additional clues as to the whereabouts of the 
Emotet botnet in its present state including to offer and provide actual enriched malicious IPs and 
related MD5s known to have been participating in the campaign. 


Sample initial data set IPs part of Emotet’s known C&C infrastructure that we used for this 
OSINT enrichment case study: 
hxxp://109.123.78.10 
hxxp://66.54.51.172 
hxxp://108.161.128.103 
hxxp://195.210.29.237 
hxxp://5.35.249.46 
hxxp://5.159.57.195 
hxxp://206.210.70.175 
hxxp://88.80.187.139 
hxxp://188.93.174.136 
hxxp://130.133.3.7 
hxxp://162.144.79.192 
hxxp://79.110.90.207 
hxxp://72.18.204.17 
hxxp://212.129.13.110 
hxxp://66.228.61.248 
hxxp://193.171.152.53 
hxxp://129.187.254.237 
hxxp://178.248.200.118 


hxxp://133.242.19.182 
hxxp://195.154.243.237 
hxxp://80.237.133.77 
hxxp://158.255.238.163 
hxxp://91.198.174.192 
hxxp://46.105.236.18 
hxxp://205.186.139.105 
hxxp://72.10.49.117 
hxxp://133.242.54.221 
hxxp://198.1.66.98 
hxxp://148.251.11.107 
hxxp://213.208.154.110 
hxxp://192.163.245.236 
hxxp://88.80.189.50 
hxxp://185.46.55.88 
hxxp://173.255.248.34 
hxxp://104.219.55.50 
hxxp://200.159.128.19 
hxxp://198.23.78.98 
hxxp://70.32.92.133 
hxxp://192.163.253.154 
hxxp://192.138.21.214 
hxxp://106.187.103.213 
hxxp://162.144.80.214 
hxxp://128.199.214.100 
hxxp://69.167.152.111 
hxxp://46.214.107.142 
hxxp://195.154.176.172 
hxxp://106.186.17.24 
hxxp://74.207.247.144 
hxxp://209.250.6.60 
hxxp://142.34.138.90 
hxxp://74.217.254.29 
hxxp://212.48.85.224 
hxxp://167.216.129.13 
hxxp://91.194.151.38 
hxxp://162.42.207.58 
hxxp://104.28.17.67 
hxxp://8.247.6.134 
hxxp://5.9.189.24 
hxxp://78.129.213.41 
hxxp://184.86.225.91 
hxxp://107.189.160.196 
hxxp://88.208.193.123 


hxxp://50.56.135.44 
hxxp://184.106.3.194 
hxxp://185.31.17.144 
hxxp://67.19.105.107 
hxxp://218.185.224 231 
hxxp://103.201.150.209 
hxxp://104.131.11.150 
hxxp://104.131.208.175 
hxxp://104.236.151.95 
hxxp://104.236.246.93 
hxxp://104.236.99.225 
hxxp://105.224.171.102 
hxxp://109.104.79.48 
hxxp://109.73.52.242 
hxxp://111.67.12.221 
hxxp://112.72.9.242 
hxxp://115.124.109.85 
hxxp://115.71.233.127 
hxxp://117.218.133.244 
hxxp://125.99.106.226 
hxxp://125.99.61.162 
hxxp://128.199.78.227 
hxxp://134.196.209.126 
hxxp://136.243.177.26 
hxxp://138.201.140.110 
hxxp://138.219.214.164 
hxxp://138.68.106.4 
hxxp://142.4.198.249 
hxxp://142.93.88.16 
hxxp://144.139.247.220 
hxxp://147.135.210.39 
hxxp://149.62.173.247 
hxxp://159.203.204.126 
hxxp://159.65.241.220 
hxxp://159.65.25.128 
hxxp://162.144.119.216 
hxxp://162.217.250.243 
hxxp://162.243.125.212 
hxxp://167.114.210.191 
hxxp://169.239.182.217 
hxxp://170.247.122.37 
hxxp://173.212.203.26 
hxxp://174.136.14.100 
hxxp://175.100.138.82 


hxxp://176.250.213.131 
hxxp://176.31.200.136 
hxxp://177.242.214.30 
hxxp://177.246.193.139 
hxxp://178.62.37.188 
hxxp://178.79.161.166 
hxxp://178.79.163.131 
hxxp://179.14.2.75 
hxxp://179.32.19.219 
hxxp://179.40.105.76 
hxxp://181.134.105.191 
hxxp://181.15.180.140 
hxxp://181.15.243.22 
hxxp://181.16.127.226 
hxxp://181.171.118.19 
hxxp://181.189.213.231 
hxxp://181.198.67.178 
hxxp://181.231.72.200 
hxxp://181.28.144.64 
hxxp://181.28.248.205 
hxxp://181.39.134.122 
hxxp://181.48.174.242 
hxxp://183.82.97.25 
hxxp://185.129.93.140 
hxxp://185.86.148.222 
hxxp://185.94.252.27 
hxxp://186.138.56.183 
hxxp://186.144.64.31 
hxxp://186.22.209.16 
hxxp://186.23.146.42 
hxxp://186.23.18.211 
hxxp://186.4.167.166 
hxxp://186.4.234.27 
hxxp://186.83.133.253 
hxxp://186.86.177.193 
hxxp://187.149.41.205 
hxxp://187.163.180.243 
hxxp://187.163.222.244 
hxxp://187.178.9.19 
hxxp://187.188.166.192 
hxxp://187.189.195.208 
hxxp://187.242.204.142 
hxxp://188.166.253.46 
hxxp://189.180.84.115 


hxxp://189.196.140.187 
hxxp://189.209.217.49 
hxxp://190.1.37.125 
hxxp://190.102.226.91 
hxxp://190.112.228.47 
hxxp://190.113.233.4 
hxxp://190.117.206.153 
hxxp://190.145.67.134 
hxxp://190.147.12.71 
hxxp://190.186.203.55 
hxxp://190.186.221.50 
hxxp://190.189.112.116 
hxxp://190.189.204.100 
hxxp://190.19.42.131 
hxxp://190.193.131.141 
hxxp://190.230.60.129 
hxxp://190.246.166.217 
hxxp://190.25.255.98 
hxxp://190.36.88.98 
hxxp://190.55.39.215 
hxxp://190.72.136.214 
hxxp://190.97.10.198 
hxxp://191.97.116.232 
hxxp://195.242.117.231 
hxxp://196.6.112.70 
hxxp://197.211.244.6 
hxxp://198.58.114.91 
hxxp://200.107.105.16 
hxxp://200.123.101.90 
hxxp://200.24.248.206 
hxxp://200.28.131.215 
hxxp://200.32.61.210 
hxxp://200.43.231.10 
hxxp://200.57.102.71 
hxxp://200.58.171.51 
hxxp://200.58.83.179 
hxxp://200.80.198.34 
hxxp://200.85.46.122 
hxxp://201.199.89.223 
hxxp://201.212.24.6 
hxxp://201.219.183.243 
hxxp://201.220.152.101 
hxxp://201.231.44.78 
hxxp://201.238.152.20 


hxxp://201.251.229.37 
hxxp://201.252.229.169 
hxxp://202.83.16.150 
hxxp://203.25.159.3 
hxxp://205.186.154.130 
hxxp://206.189.98.125 
hxxp://211.63.71.72 
hxxp://212.71.234.16 
hxxp://213.120.104.180 
hxxp://216.98.148.136 
hxxp://216.98.148.156 
hxxp://217.113.27.158 
hxxp://217.13.106.160 
hxxp://217.92.171.167 
hxxp://219.74.237.49 
hxxp://222.214.218.136 
hxxp://222.214.218.192 
hxxp://225.153.252.228 
hxxp://77.122.183.203 
hxxp://109.123.78.10 
hxxp://66.54.51.172 
hxxp://108.161.128.103 
hxxp://195.210.29.237 
hxxp://5.35.249.46 
hxxp://5.159.57.195 
hxxp://206.210.70.175 
hxxp://88.80.187.139 
hxxp://188.93.174.136 
hxxp://130.133.3.7 
hxxp://162.144.79.192 
hxxp://79.110.90.207 
hxxp://72.18.204.17 
hxxp://212.129.13.110 
hxxp://66.228.61.248 
hxxp://193.171.152.53 
hxxp://129.187.254.237 
hxxp://178.248.200.118 
hxxp://133.242.19.182 
hxxp://195.154.243.237 
hxxp://80.237.133.77 
hxxp://158.255.238.163 
hxxp://91.198.174.192 
hxxp://46.105.236.18 
hxxp://205.186.139.105 


hxxp://72.10.49.117 
hxxp://133.242.54.221 
hxxp://198.1.66.98 
hxxp://148.251.11.107 
hxxp://213.208.154.110 
hxxp://192.163.245.236 
hxxp://88.80.189.50 
hxxp://185.46.55.88 
hxxp://173.255.248.34 
hxxp://104.219.55.50 
hxxp://200.159.128.19 
hxxp://198.23.78.98 
hxxp://70.32.92.133 
hxxp://192.163.253.154 
hxxp://192.138.21.214 
hxxp://106.187.103.213 
hxxp://162.144.80.214 
hxxp://128.199.214.100 
hxxp://69.167.152.111 
hxxp://46.214.107.142 
hxxp://195.154.176.172 
hxxp://106.186.17.24 
hxxp://74.207.247.144 
hxxp://209.250.6.60 
hxxp://142.34.138.90 
hxxp://74.217.254.29 
hxxp://212.48.85.224 
hxxp://167.216.129.13 
hxxp://91.194.151.38 
hxxp://162.42.207.58 
hxxp://104.28.17.67 
hxxp://8.247.6.134 
hxxp://5.9.189.24 
hxxp://78.129.213.41 
hxxp://184.86.225.91 
hxxp://107.189.160.196 
hxxp://88.208.193.123 
hxxp://50.56.135.44 
hxxp://184.106.3.194 
hxxp://185.31.17.144 
hxxp://67.19.105.107 
hxxp://218.185.224 231 


06. Basic OSINT Enrichment Process 


In this analysis we’ve decided to share the actual findings based on our research which include the 
actual malicious IPs and the actual C&C communication channel domains including the actual MD5s 
known to have participated in the campaign with the idea to assist legitimate cybercrime researchers 
and OSINT analysts on their way to properly profile and participate in additional OSINT enrichment 
and processing efforts. 


Sample Emotet C&C hosting IPs known to have participated in the campaign and to be 
currently participating in a rogue Botnet C&C hosting infrastructure: 


47.88.102.103 
172.67.191.39 
79.127.127.67 
172.217.12.232 
104.21.68.66 
142.250.179.168 
172.217.13.226 
173.194.221.100 
172.217.7.234 
142.250.73.232 
173.194.221.113 
104.21.87.7 
173.194.221.101 
172.217.164.170 
104.193.88.123 
173.194.221.139 
104.193.88.77 
64.233.162.97 
142.250.65.67 
172.217.2.106 
173.194.221.138 
172.217.20.110 
157.240.229.60 
172.217.5.234 
195.208.0.102 
172.217.7.226 
216.239.35.8 
104.21.46.196 
172.67.141.149 
23.37.43.27 
104.20.209.21 
51.254.83.231 
51.68.44.27 
129.250.35.250 


129.250.35.251 
94.130.16.178 
104.16.159.17 
54.38.92.92 
23.51.123.27 
172.217.12.228 
178.124.148.47 
172.217.164.138 
34.194.44.150 
172.217.15.66 
151.139.128.14 
79.127.127.68 
104.16.158.17 
93.184.220.29 
37.156.147.163 
178.216.250.130 
185.229.29.6 
54.198.239.119 
185.49.85.182 
77.238.123.22 
172.67.129.244 
104.21.2.253 
91.240.60.19 
185.49.84.241 
95.100.96.224 
45.60.150.224 
209.126.123.13 
172.217.17.104 
172.67.75.164 
151.106.116.14 
104.26.8.205 
774.120.188.204 
23.196.76.23 
172.217.164.174 
104.26.9.205 
151.101.66.133 
172.217.164.142 
172.67.147.133 
172.217.7.138 
142.250.65.78 
172.217.8.10 
172.217.15.104 
23.47 .204.33 
23.47.64.24 


142.215.208.235 
23.47.204.7 
17.253.21.203 
23.15.136.53 
17.253.21.208 
23.48.105.43 
17.57.12.11 
23.15.137.53 
54.189.10.237 
184.51.0.218 
172.217.8.3 
72.21.81.200 
173.194.73.95 
195.28.169.8 
10.10.34.35 
89.31.108.3 
20.50.2.20 
142.250.65.65 
104.26.6.55 
192.166.47.85 
99.86.186.71 
35.214.117.149 
172.217.164.163 
103.21.58.122 
185.194.141.58 
173.194.73.101 
79.127.127.9 
172.67.142.66 
779.127.127.115 
64.233.161.113 
151.236.35.134 
173.194.73.139 
173.194.73.100 
51.89.107.116 
150.95.219.152 
185.49.85.39 
173.194.73.113 
142.250.102.188 
216.58.206.234 
172.217.164.168 
172.253.120.188 
194.177.34.116 
172.217.12.234 
185.254.100.25 


172.217.9.195 
51.210.80.126 
172.217.15.106 
82.66.249.102 
172.217.7.228 
172.217.8.2 
172.217.13.67 
172.217.19.227 
142.250.73.238 
8.252.65.126 
172.217.15.65 
172.217.12.238 
8.253.151.249 
94.75.229.248 
35.186.238.101 
205.185.216.42 
111.13.171.6 
47.246.109.108 
47.246.109.109 
172.253.122.188 
111.13.108.121 
111.13.171.5 
111.13.108.123 
111.13.108.122 
172.217.15.78 
172.217.8.13 
173.194.184.135 
172.217.7.170 
59.111.163.254 
172.217.7.131 
94.130.163.40 
223.252.199.69 
123.58.180.77 
94.130.16.179 
223.252.198.124 
223.252.198.123 
142.250.13.188 
178.216.248.179 
59.111.160.194 
185.73.115.2 
64.18.17.135 
142.250.73.206 
59.111.181.166 
78.157.36.80 


165.22.6.204 
206.189.206.249 
37.140.192.209 
78.41.204.30 
185.236.37.98 
23.6.119.33 
151.101.64.217 
151.101.128.217 
151.101.192.217 
212.33.195.42 
54.187.159.182 
116.203.149.169 
52.36.251.83 
104.22.71.197 
17.248.131.230 
104.123.200.28 
52.218.252.72 
172.67.39.148 
151.101.0.217 
104.22.70.197 
151.101.0.176 
144.76.81.68 
104.31.87.135 
104.26.9.195 
127.0.0.1 
172.67.72.121 
104.26.8.195 
142.250.73.234 
172.217.7.202 
142.250.73.202 
172.217.164.162 
104.97.85.54 
172.217.7.132 
142.250.73.195 
157.185.177.205 
79.127.127.74 
13.32.196.131 
13.32.196.199 
13.32.196.194 
13.32.196.133 
52.213.137.28 
157.185.165.41 
72.21.91.29 
104.97.85.29 


172.217.13.72 
67.208.88.198 
172.217.13.78 
67.208.88.211 
99.86.38.18 
172.217.9.196 
173.194.221.102 
172.217.9.202 
13.32.200.109 
185.8.172.111 
158.69.187.205 
142.250.73.228 
13.32.200.12 
13.32.200.25 
162.217.98.146 
51.222.30.164 
72.21.81.240 
142.250.73.227 


Sample MD5s known to have participated in the campaign and are currently communicating 
with the Emotet botnet: 


d502444891a15f060a7aa8e2d78eaa35e4 1346ac02c81ce34eb1aef8597f32be 
59e8dc10bfa78cc4fb00659f3a5e97 96f0fe8557 03abe3538 1 9a6292d1f3d2d9 
5fbdab36ff5756ac8e58c3e56bc4ce4963969499022789a4cea/c/83cbc3d7a2 
6d3dc61aa4568b9b 1 fo8658fe51 5d24792e736bb587796bab5e91b144a56a400 
5bf3afa0ac4e 1154fca60e7bf20f168e28a0a148401230a2962b659 1e4bbcb70 
921d0bc27d9c2ca26a8d5af2856e442460974b666390c437dd5dcd2f66c7a07d 
7065534896d3b90f10cc527f14272bf6dd1df126497f5098e1 d0d03a0b69bfea 
a6f3cd4c2ae8b90fdb49e9ccc5cfc467bf56c277bbcb654a04e51b87524582ba 
19e52375e54cabc8bf4aa8c37d6aa5600dcc4d70405e7b44e0a59d937290ef70 
431cbf05a7c29b540566c78f1 7afb4685e6deb405bb4ac4c2a989d81cfe4d68c 
14b1ff1a7eb014c761cdaa49a27b0d0360a1ab568dbdd4d197eab757e597ec0d 
30e36700baac32ffeba1c10e904470be88585273f51f942b0fb2346b36b1e13e 
5b127433ee874f7158dd7 183e5bdaca8b0d0ad2eae7b28f69ce6a59f2bd101 8b 
262754341 9e2229e2b3445e4530e270c60b4c7b0b1 882757 a1 8ad5f729ee62889 
7526436a4dc55a848f0517b1204ca7e7d749cfb3bb62c0237605fb9fb2a2ba5c 
56038022d89df874a7a3158328b1a2b522b361cb6f028e1 bO3f3eda1e2b1 7f88 
e€6308496a22d31 7cf7e5a5469351c5cf4dc11ef7e47b39e9a97ea85707cbec8a 
a35b999ea8bb3f2388c4 51 038ebdb66ef75ae727dd11ab76ea4da3894b488faa 
bd47f14b2c97c3788f13151d31635fdd5566ab7d28cdd2b2f7fdef8aa79d7412 
42acba42c177df002d6b2ba5cfa9a20ae7 8e5b3e0f67d274bb9a5d 10d8199aee 
4655d5e41838228ec40bb602c3ac95f12e0a337f0d3a63f1 5cO50b9dbf3bb691 
5516313218fe6653 1 bb8ecefcc8fbbfb37a075dd48f681 9421 9f80b6e2cd3af1 


2161 62ced7b98f2c43dfefaf55febc9 1 12bda1343b8493e2267ec315787d518e 
83162b91a932f87da0762bfa4947 1 5dd4f06c273cda4494fa05cc3532fb704ec 
b7c92fa1d3d23a9708a69987 b8ad4f01 7fd1f09e 14447684c5883a402819b3a2 
6a605ccc32e5c547bd6f1a7f58108c8d9 1d3c80002d38e7a66357 3bb662de0d6 
8fc7538da256db 1b573a096ebfd047f3f055dc6b3ad55695c727988765d007e0 
6e252c68ecbO0fa83aba1c58c2e7 3a8ddfeb78055046c9838c87695ef5a3668c3 
2cafceb03ae7664da68cab086 1f837b43e67 7d9530d594eb37 1 367 1 2af2ef27f 
dac6609fbf3ca2c2a1 5bc40cf79af9bc5c7c155ccae3 1636a90e745f132a6e2d 
839781 b06efc3c0609bbc1749048336d866 1 3de41 8f87c6e2126406d59a6c87d 
355be4be28375e1b9d538183623c63a696f5ec96 1 83dca5024 142d0f06de2195 
6f6480747deb74abbb4c39e9c1 bcebf9852a89bb886809F91f4 1 cff3c944e4a3 
ea8bf79368adc49dd51618ef830b0440edda540af5b08996efb3d33fb7d57a74 
ed03ff77eb8eee60c0eat7323427206464d053d35e40f211f756461d6cc830dd 
84814627daf5dc0e87c67a5d05ef49c7 132f45e1f47ef 19644091 01daf266511 
00054a00efc35255e8df5b24d81 e102357b951a222bf2afl fd5662e0dc6a1 34d 
de79dbe3f4bd7a5c6ebe3c007 b8d4ffbbf4c1 9fc7ad30127e7 1ec0a7855f21da 
#854e18d7ed6dbd47a288559e666 79bda6b626f9 1 f9fdcedfdedf1317493640b 
674f447b67fa6481c04d7d4c7dc47ecc0d3956c0c7b9006c845efebbc8fb31 8f 
2c4ca41292c07252bb043dae7697a91c1 40ba9be82fach5cd62c9f9c802959e0d 
4241921870ae6fee9cef8a48cfa99f2189dd6d2e88ea22bff6caf6474d7d3ee0 
c8f5fab9ca9289342ae92ed 1 ef056e687f906fc40bbcfe2bee55d6391 57e06f4 
f3ec4 1acbd141572f40d6f62a2838325980d255ea1 7490767851 bfa250e645e7 
3f33ae4ea87e4c2f3b2c60152da482a116e9c453662ac438b50458e56edcd87c 
bba5332c6f0d44bc3f2935842dfbcc051f3edb 1b7f186a94c66527 1ccca13755 
8053049ccb4c8e1814963a96433e57866b9ba9041 fc6ddfdce95cdb7d46960c8 
924eb76324c5ed9caf4d0a8f1a76ddc3f2a372b74619483f86e0e5fb41 1a3f2d 
£7d87c8a2844948f44a57d1ee3c804c106a51942ff4110d3ce8780334a7a4 78 
b8c2109f68133a0582d5e29d09f1a38562b535eb9bd501d11793e4ab7218ca40 
eaec9d2fea105c5379c7ab7 109799650a489ed8a7b2ac936f8aae31056a62ccb 
C9467 8f76173034fe05e4d5d22e00a24a64f461 7ef42f7df73b219d41838d56e 
d6825e0796be863bd54db437039a6095d451b0bc9326504352a597fa5547b221 
6452bb1003401 36bacfe46a6c14d211f409144fe09 197 68fde8feb52536583a5 
bfad25aff47173d653fc501f575068c3be0c476f1ecda78926f494dbedd15a9e 
350303903aa5a7066b63be4ac7 1e134a9036d7c3f44 bddd5cda088f792d8e42d 
3d1e476cc4aca5205fc0e1 7a8e3b1a0c4c0f7340d80abccd0d9070aeeb9ab6fef 
5438 104f41 6bb8a85e335287 1 e0d05b 137548134 af6 1 6058ddb3f98bde0d 1353 
8 1 bfdf839b895eb2e 1662f1ea1 08abe6be9e83cd254c927 65ff886ab8612335c 
8c6389fc67ddcd8b8342a02825b3278e7722a31 9ccc71dbccdd5bbcebb7997aé6 
ffid41b936a6a0c7a94a2b6a00db4dd32d5b173f5803659ebaff78d57adef0 Ifa 
29c11ae8589ed628ac393b2f445de1d4743c07aec8b7a95b1 247d354aa32480e 
4d18781f33a23c925af01094bdd4f9d1c94f5a2e36bebe2add6f4fcc0f1 92bc2 
8a380e04d3d765df27a743e30ac09d57572a507 1 4eabb9c2d7be 108a322a20ca 
520657d4c787ef47085ee60a 1 96a654d65439e574b39c4 5df794fc2b7 bfff48d 
7597 7d3263020c87f5b9b68394c4 39 1 5fb564624d2597cdced711c91a93750d48 


b7f859e49de68440a4dee0b87d204f49701 749fdbcf42atb4542c90c7fa22803 
84f18b060db22abb3acb3883e0eba5d94 af 188863d438d2ff7b9e29ca1 db56f9 
8f338dd389884 7d9b9e5chd1 fcfc7cd3da57acba9f67c54 1 fOfb6ef67f63302c 
1d51d8e9ae1d67cb804fb28024b04969fd5888c3befece09547e5506ee946027 
96929bc0d6b4e6563bca34b9 16ef56248492329520595f70f4d0be25c1f2b05a 
911e951 dfff90bbfaeOc2d360abc52ece0766b599d0f9e177056ce860b5 1fe7 1 
efo36535ab077 b0a70bcb866701cdc3503658a47f0aed434a6ece0d48b4826624 
e5a9110260dc73127826adcatcf04947442f465c423b823b05cc05cf686ce998 
£7a641923d31 3ffe0829bf4dffidb26b5af0988053d1e1aeab7cb8aa0afb7588 
f728506d426be49e63f9b2086adf2646 101 f3ffb47 9e6d53a7943b3fca0 OFf7F 
7ca71af07895777a5751 cc2f6cf1e36c62cebd1c175f129884d55d3628d79477 
82d52d986f4a52 1f16e0a8e7657a6 187 1fcOc7f4c31 9abb/cf5dff48392facd2 
3172427a172f3d348a885a8e691aa9a52d786079e1d711 7cfeff9dacea0d726c 
bc916075af08babba3d 1 2e8bee5ce166e709a54e231 3e3690beffd3836c7d057 
2c7211a44d025ad60822c479051 2fd8c1 73e6f5d87cb7d8a7df6df5bfb4b94f2 
88aa6a357a62445b751ee11303a56a63399cee 1 f646ee88759ca53267157adbb 
e€e0096463b435c189c6bae52697a0657ab8ec1187cb325627c08be8ce26f4daae 
02622de4a84c051dce772090333dc9039e39F11bfe10a7d26b7de34c8191e584 
abd1424b1f25b3aa337a1202642a18a73f8ebe29 1 3e0f0f0999eaf2859044b24 
bdc31ecc81076f27b4f28637c2d31047ebc9062a2fda83db2ae840aafbd6e0b8 
3420bd568900354803e2ca6c7c7af01d54935a21520fec469fc9d6b8acd3a38d 
5631d4e5a760d5a4ec873ae9607e7 333b7337aabbe4 1 6ddde057bf4b08c2aec7 
2912f3a598914122ce7a5ac9a68 1646 7fe3ca8fb6c5159e5d365817420d2b041 
98eebf017259d5b3201 ca3f75ebc8ab9bd 1359edf38027cebc335921 df95fb1 1 
f0e83f121613ebc055945 1 f90a89dfc96F738fae3d800500c395fc72d54e53e5 
5813d5c959472766c1d32d638caf56e7fd939b4 21 fb5870b3c592c6d4c59554b 
720cdcfd8ffic38395c3fa468923d14b805a77e07b41cb9540abe809be67793ed 
1ab235c5a9ba88290c009320fc7359f72b42a54d327e7b56d6f5f9c9d 1 762d0d 
3184 13fce87303db0348c26217206a9a1c3920fa734b791c0c10cb1cad134c0e 
eb3d33e8d35429ed881 9bcd3e23ab979881 Odfc94fe97458ce1 efedfaNae9c30 
7a2083d97760c329b72ac29444a92541db830174189a2c343d26b93e02f558b8 
f6b8aada798c1218289bb635aabce9b0Ff8 1 0ebS95f06f53db1 7 50fdc5921b195 
483bb5bf9138d0b69d7 20387 9a86cfdSde6cbd9215cee61b1bfbc55f40d42d4c 
c96625e957c9f1 2ce8ad7074447802938d206b514aeb1cd78a8a2c979b447f2c 
087d8d5e47648af973c9628248577dc33b26d15c1 fd74cd38fbd7433f1f07adc 
72cc66633a854dd8c5c43327bebe39ece60 150ab851e735bd97eed4a8c4a25f5 
1a725fabb240a11d201d323201a3d98eb749ec34d680eace3635d50a44b544ae 
d12aa2ff14346904d556c7eb8032da70287 05ff7ec5f9df742e62542b3ed70a5 
€948d320e1 29dacea4d022555c03e90d3797 7b32c45bd58 1 00acdf26d896f639 
ac4ad2feeb0e5cee792544 1 6ba88ea2ch72af8bb2e8 1 35d8208ecdfd3db2b08f 
3ec5b5b5923684d91 edf1c5c5ec037f8aa399928be4e32F7 17 bd8a3b623dbec5 
099ca6c2252e3e94d6 199e4cal ef54cd3fd3fe6820cb1988a03b93100b3ab685 
b5c5f15901d303d1135b94fc53 148c4358be9c36fcd9 114581 ef3290 10655236 
41635ffaeb93b8e1 c9b3f09f9e4 5ef3384587 d6e2b8d24cfc72cabca119c7cdd 


2a6076fc8d5cbd48477320f392fc59177931f884620375741 8b062bddfed6902 
0461 721df37c8d27491e1ce9708000ce18823a38222ae99 1 02f448ecea63d4f13 
17cd84a5e5246dfbd4c944 1 7ade88d4a58426b5926689d3135309191a181b059 
9079ad5b00664 7ff899 70689bbd2936 7d8fa16a6a242829b42b88d88bfb78456 
d22cd6a219464a90cfd2cebbaa94727c8efa7 3d936b680501c4495a900069d21 
c82c0ee05026242ce254f0 1 400399f89f69c32e7c84d6ccf85c2cfe6338a4ae6 
d4a74735785dfbfd340064e834462258f90 16097da8aa9f92f5fc843e2d22b34 
88714578fbce5ab5765a9c92dd446cfaa5cb30059c2242255d6fcd336cfa2df3 
80362 1bd13695b1426867fe5b2562aa92e3e31cc2f81d149b332718b32a86773 
11e3497c317e0683a8ddcdeed0d76b7a4a77144b3b4221 8203a27f848ef227 8f 
837b994c1c16a3a7b7 1a4641 bae85313f145893d63434842af05d226e8aal db 
8c7203746080fe87d79d839504ec4dbbff0e2e6ad2e2c7bc4133ed78c010f77e 
d8433b324f9acfbbfd9df3bc83b883eb2487 d9fae9Ybc98bf3521 de 1b63d84fe 
1f4259e2b808cd00fc825f0e39a2b22ff4aea6caad1 75f1e4567dba0bf296dca 
b67a7114363f1ca7d632d867de1 ee600b29c14fd5b72062a7 8baedfa164a3422 
5924b7517a90ab49af51 96fa1088bad29bff38adb93bc1012c5c3f73a7 1002899 
b7670a2f62f6d9 14c4d50a5e7d7211e3c039e692c99bba34329223b3cc8768c5 
d832f2f912d3ecfaab38929bf883b85034 759f2226782095d37928d71657f1cb 
9e7dcbab5f3d5d3c891c3269204db2f29ae3a09d 12357969a3024 ffe1 5389df1 
09891d0a5f1ea375ef7d1e686a5584b475af1 f03cfd26a402490664bc102651¢c 
3db96a39a3c568b8d9eed53594 1f1c4462ddb2c69c2ac6bb17a9c8503e8349e5 
8ebce814309a1 4efaf5e6fbafbb7 b94dd326f6f1d51f51553e8fa5 7f6849ebb0 
8207 7b62b2dc216051f339d53ec8a7371514fec6083ddb/dc22bc7ff0a6fcf54 
25fe3ec63ee931 15e2bdf21df72c81 1fc9a4c1cea59c10346e7ff70c2cba8c32 
e47058323d68aceabb1abd44e2a01d7846a19e37c1 9bOcb07d2eb6cc4fea77e1 
fd9f3787 b68f543ff2a47 2b7d03708460 1 ef33d6111c91ab0bO0dec4bbbcf93da 
7b2d1badf1dbc5c3b9f3d7 8f90c0ec2bdba52b70e6b235c3c0689aea 17073753 
56ee556a6f6afccd14e2ab22dfficb5d102d4742216a6a2c640eadf5f368c60b8 
1e8896de7976350abcdf4319e846eda06a24a05806cC589a9235c6a6d610cd009 
4839206b6b4d1 166f009e8ef396bb5c2a59983be5c12de4c54e58ce8da3b08 1f 
e487aecad47c812f0513404bb5f12347249dc4f1e401cb99f6efb1 be1 783052c 
54b6e76217c78e631418c56c1 7 8feaeaeea2eaeb975a871e91 5dd69314cea08c 
8d3cO0cb1dbbc09083467 3db10bdf056bd350babe1 ce6bf30926e 1 6fe6e864b82 
3306424a330C62825ee75c0979cd62a7304c1e50a869e4688765a37c7c3a60f96 
92a268ff0f59c4222cee438c6d5fdcfebcb29fda0 14a9d458701ceab34204b79 
cdbd7cba3fd1963beb79aa159f20103952feebf62de75a73907 3b08c3c6f7bbc 
046f32f43f82f6a475cc211ca4be25f8df983efab3053fd256a5072d9506b4f3 
7491dc14d2ec88698a1758e4cd930522f4d3a68d 1 fb81 30adb7 581 8f94d1 Ofe8 
93a2fdc063c9bd169f2e7664fa5d8a1484ca977 25eb8f34d543d7a6d07 b2b0d0 
8e5089260064a95581 9a92ebccc43d05520e32d234dd3c1 76bed5f6d0665ebdb 
27d900a302faffbdf9145b802ee32779f484 17637ea94 70d06f2772a2aeebe08 
fde9624050c1f5cd620568edd5260e1 7f234c07539a84353 1 6bf3b9fc4350503 
e€08d3303ca393e63c2d202d8a82abe3037f99ebb 70b8Ff3 1 2f86ed59eae20d888 
3ab78388338a4de1 58a445d338389abf70268cfee4 74ba06a64d15ba21b783d6 


7c5cdc5b738f5d7b40140f2cc0a73db61845b45cbc2a297 bee2d950657cab658 
15dafe76124cb0239e7593932864feddefc1 2cfe2243f3ca51c968c597bb62c5 
7617fa1febbd7a84d93de644288d4b957564439fecf78129ccd4507ce700225e 
e151c10ca1bd2c8ec3dfa403595402778c44287819362151ae647c11febaa91e 
63f8450d3c9f65a624fa65d8e760fb3baf430de9eb6dff4efc096e7f3e2ac756b 
ceffc6c3257 1aGae037ace18409e4 79a6cef4d6f58e0258ec206d79a5fabde2d 
4344e4f149509864 11 5bcf80b5b1613ca270c72ec6f8fb0497 1 bdc7af4a40a66 
b8ffa044c1aa76470b3ad334f834da777/ef7 1685324976 10d00b128d37fc6a54 
a/5fa23ea8 16abe4a2ada31182aea5bb12748317be14ef2808607070d92cbefc 
791995d3e1 cfd697b9ad833e1712357a476f1538c38a001 925ce94d3ae39edb8 
2259e2aebc1913304c78125e6c12e0924b34ab 1 1d3e848078579598f1c21ed53 
c0285a05f35e5c7ac9b7436dcc0fdefb62400b8d869e5514 1a7ea84268ae970a 
5cd2567af0ff3769b687ad9feacf8c52eb 7f6 14e2b7 4ad3b0cb437 30c1 edOfbf 
3fa0467b0065337 1f6ebc7dc29150664ad6e46c575ef0ca84a1c99ea1 ece8304 
72607¢261f87955ff646339ffF7063bebdc1 7450a24ef35233ef9c31d349c2853 
O0d1e9dedd01466b3af1618afa5a68f09c539ab7e18c051d7fbad39167b408532 
24dca71173df1041b4001384ca041a43e13175ed76289269babb0dc99e0967bc 
face11cb17a829f57724e785d82da0a66440ba7602b825b9a7 a1 0be84b933f10 
ae20504e6fcab7 ebe3f0231f8f3361d762ff27bb6b5ca475d3b051f6c7a1411Ff 
aa643c7015e6756d6ecd40516e6ad89421c700b79ce73f025f85dd8bc5b403e7 
8a08d166de154bb0fc1f8967e5cd532c8e220467e3c500c26e8067 8c89ce4999 
f2ff6cObd9769a73702ba3e884 1 fb336c688ea576574485f2 14 bef292883e0f4 
05a309eed80bae33ef2b14f7a27eb3ead1b986e52e697fd19d09a61a336dfebb 
75a5322c544ee488e43b4fbacd2ced7baa0be9f8b39a97a52826f7f4f848256e 
291b997 3fe526ce91 9aa0380023a51 96486ef1 a0dc97 25ff294ce0d707a6f8de 
3750426d803ed01969ed3b7 2f4fa4 4ba882eff093be46 1 23f0b033e6612eb074 
43d193a8aca0282af9924d9b39f61a9e1 3382389f1 f4ae2995ebc561ed628ef6 
21969fb77a8e1f7e9722d0d56d70d8e389bcaaé 1 5cb6e4c1 dad3d6efaaddf820 
cd67c520901aa38fa95 14205a9c7b9c2164a465f6d380c13851 df538e47dbc3e 
88b84f4d33601 5d8547 3f3bb82598299b4e29bceadd2260df3fa3ca34c10451e 
3a1ce084369d7a1b98c0a783f2f9757 59cf036af6a5ca0c3a22b648075bad5cc 
66edbd54b9283da3b83e8fd81f0a972213447b308c53eb81 7 707 bfe75921d014 
53d075b5be564 101 c888a82 187527845404 a2df42e7ae774937f9630da98ic3a 
bd4cba6/d7a4bae4d17f9148428d5555e68ef6359ae91 46e859cacb103993798 
d4b3542a748e633b83446722152488888db45d2f046c45fdcadf7088d173e1ab 
12be388bdf962499481 86b0300fe0 186684756 29c2cfdd552274459b11e15714 
3241dc0ab511ce51306324e0a0810d64685086f787543b07cd64d596836cba45 
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07. Conclusion 


Despite the ongoing Law Enforcement and community response actions targeting and aiming to 
disrupt the Emotet botnet we believe that systematically and persistently monitoring the Emotet botnet 
would prove to provide valuable results for the security community and Law Enforcement for the 
purpose of tracking down monitoring and attempting to shut down the Emotet botnet. 


We will continue providing relevant and related case studies on various botnets that are currently in 
circulation using Maltego and WhoisXML API for the purpose of establishing the foundations for a 
successful botnet C&C infrastructure monitoring and mapping including active cyber attack attribution 
campaigns. 


